Communications security methods for supporting end-to-end security associations

• US 20040098622A1
• Filed: 10/15/2003
• Published: 05/20/2004
• Est. Priority Date: 11/14/2002
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: OʼNeill, Alan
• Granted Patent: US 7,937,578 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/167 Adaptation for transition between two IP versions, e.g. between IPv4 and IPv6 translation of Internet protocol [IP] addresses H04L61/2503
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

Methods and apparatus facilitating mobile node paging in a system where a mobile node is able to hand off application processing to an application proxy are described. Paging determinations are made based on application processing results corresponding to processing the content of multiple packet payloads. In some cases paging determinations are made based on processing the payload of a single packet in conjunction with information received from a mobile node, e.g., intermediate application processing results, mobile node state information, etc. To facilitate application processing handoffs in a manner that is transparent to a peer node involved in an ongoing communications session with the mobile node, security information may be passed between the mobile node and the application proxy node in a manner that is transparent to the peer node allowing an end to end security association to be maintained throughout the communications session with the peer node.

Claims

1. A communications method for use in a system including comprising a first, second and third nodes, and a first secret, said first secret being shared between the first and second nodes to secure communications between said first and second nodes, the method comprising:

operating the first node to establish a secure communications session with said second node using the first shared secret to secure the contents of packets communicated from the first node that are directed to the second node as part of the secure communications session;

operating a third node which is coupled to said first and second nodes to maintain in memory a copy of said first shared secret; and

operating the third node to receive a secure flow of packets from the first node that are directed to said second node as part of the secure communications session.

2. The method of claim 1, further comprising:

operating the third node to receive from said second node the first shared secret and to store the first shared secret in memory, said received first shared secret being encrypted using a second shared secret known to the second and third nodes.

3. The method of claim 2, further comprising:

operating said third node to receive and process packets sent from said first node as part of said established communications session, said third node sending a message to the first node indicating successful receipt of packets by said second node.

4. The method of claim 3, wherein said third node uses said first shared secret to secure the message to the first node.

7. The method of claim 1, further comprising:

operating the third node to inspect the secure packet flow from the first node, said step of inspecting said secure packet flow including performing at least one of a group of security steps which use the first shared secret, said group of security steps comprising;

decrypting a packet, integrity checking contents of a packet, and authenticating a sender of a packet.

8. The method of claim 7, further comprising:

operating the third node to drop the packet from the packet flow if the performed at least one of the group of security checks fails.

9. The method of claim 7, further comprising:

operating the third node to additionally process the packets from the packet flow if no performed security check in said group of security checks fails.

10. The method of claim 9, further comprising:

operating the third node to identify a packet with a disallowed packet payload by comparing at least a portion of the payload of each packet in the packet flow to information indicating allowed packet payloads, payloads of a type which are not indicated by said information being disallowed packet payloads.

11. The method of claim 10, further comprising:

operating the third node to drop an identified packet with a disallowed packet payload.

12. The method of claim 10, further comprising:

operating the third node to modify the packet payload of packets identified to include a disallowed packet payload based on stored information indicating payload modifications to be made to disallowed packet payloads.

13. The method of claim 12, wherein the modified payload generated by modifying a packet payload includes a message indicating that an erroneous payload was detected at the third node.

14. The method of claim 10, further comprising:

operating the third node to process at least two packets in the packet flow to produce at least a third packet.

15. The method of claim 9, further comprising;

operating the third node to generate an additional packet flow from the received packet flow directed to the second node and to forward the additional packet flow to the second node, packets in said additional packet flow having a source address corresponding to the first node and a destination address corresponding to the second node, said step of generating an additional packet flow including at least one of a group of security steps which use the first shared secret, the group of security steps consisting of;

encrypting a packet, adding an integrity check for the contents of the packet, and adding an authenticator check for the packet sender.

16. The method of claim 1, wherein the second and third nodes each include a second secret used to secure communications between the third node and the second node, the method further comprising:

operating the third node to generate an additional packet flow from the received packet flow directed to the second node and to forward the additional packet flow to the second node, packets in said additional packet flow having a source address corresponding to the third node and a destination address corresponding to the second node, said step of generating an additional packet flow including at least one of a group of security steps which use the second shared secret, the group of security steps consisting of;

encrypting a packet, adding an integrity check for the contents of the packet, and adding an authenticator check for the packet sender.

17. The method of claim 16, further comprising:

operating the second node to communicate the first shared secret to the third node, the first shared secret being encrypted using the second shared secret.

18. The method of claim 17, further comprising:

mutually authenticating the second and third nodes prior to the second node transmitting the first shared secret to the third node.

5. The method of claim 5, wherein said third node operates as an application proxy for said second node during said secure communications session without informing said first node that the third node is acting as a proxy in the place of said second node.

6. The method of claim 5, further comprising:

operating the third node to transmit information obtained from said communications session while said third node was acting as a proxy for said second node to said second node; and

operating the second node to continue the secure communications session with the first node.

19. A communications system, comprising:

a first node including a first shared secret and a communications application for establishing a secure communications session using said first shared secret to secure packets communicated as part of said secure communications session;

a mobile node including said first shared secret, a second shared secret, and at least one communications application for maintaining a secure communications session with said first node using said first shared secret;

an intermediate node, coupled to said first node and said mobile node, said intermediate node including said first shared secret and said second shared secret, said intermediate node including;

means for processing packets directed by said first node towards said mobile node as part of a secure communications session using said first shared secret; and

means for sending a message to said first node secured by said first shared secret indicating successful receipt of said packets by said mobile node.

20. The communication system of claim 19, wherein said intermediate node further includes:

means for communicating information generated by processing packets directed to said mobile node to said mobile node in packets secured using said second shared secret, said information being the result of application processing performed on the payload of at least two data packets to generate information not present in either of the two data packets.

21. The communication system of claim 20, wherein the mobile node includes means for sending said first shared secret to said intermediate node in an encrypted format resulting encryption processing using said second shared secret.